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REMARKS 

Claims 1-34 are pending* In view of the following remarks, Applicant 
respectfully requests reconsideration and allowance of the subject application. 

The § 101 Re jections 

Claim 32 stands rejected under 35 U.S.C 101 as allegedly being drawn to 
non-statutory subject matter. The Office argues: "[t]he claim solely teaches the 
manipulation of abstract data, and is not tangibly embodied/ 9 Applicant disagrees 
and requests reconsideration. 

Guidelines for application of 35 U.S.C. §101 are found in MPEP 2106, 
entitled "Patentable Subject Matter - Computer-Related Inventions". This MPEP 
section sets guidelines for determination of statutory subject matter. 

This MPEP section discusses focusing on whether or not the claimed 
subject matter accomplishes a practical application. That is, the claimed subject 
matter must produce a "useful, concrete and tangible result/ 1 State Street, 149 
F.3d at 1373, 47 USPQ2d at 1601-02. Here, claim 32 recites a method producing 
a "useful, concrete and tangible result" by defining a search pattern, screening 
received input strings using the search pattern, and implementing a remedial action 
if the search pattern is found to contain an attack pattern. 

As an example of subject matter that embodies the spirit of this claim and 
produces a "useful, concrete and tangible result", the Office is directed to the 
Specification starting on page 11, line 4 through page 12, which is reproduced 
below for the Office's convenience. 

Web Seiner Pattern Matching 
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Fig. 3 shows a flow diagram that describes steps in an input string 
screening method for a Web server in accordance with one embodiment of 
the invention. Step 200 determines an attack pattern that can be used to 
attack a Web server. One way in which this determination can be made is 
by simply observing over time, which attacks on a Web server are 
successful. Another way to determine an attack pattern is to recognize that 
there are input string characteristics that can be problematic for a Web 
server. For example, input strings that contain the pattern can be 
problematic because they might enable an individual to inappropriately 
"walk** up a directory tree. Additionally, attack patterns can be determined 
by recognizing that there are certain characters that are simply not 
appropriate for inclusion in an input string- Examples of certain operators 
were given above. 

With one or more attack patterns having been determined, step 202 
defines a search pattern that can be used to detect the attack pattern. A 
search pattern is an expression that is compared with input strings to 
determine whether there is a matching search pattern in the input string. In 
the described embodiment, a search pattern can be formatted syntactically 
in a manner that allows specification of both identity and variability among 
constituent parts of an input string. Thus, the search pattern can include 
literal parts that call for an exact character-by-character match between 
those parts and corresponding parts of the input string, and variable parts 
that allow for inexact matches or no match at all between those parts and 
corresponding parts of the input string. An input string is said to **match" a 
search pattern if the search pattern is found anywhere within the input 
string as specified by the search pattern. In the described embodiment, one 
or more search patterns are specified as regular expressions. In a regular 
expression, each character matches itself, unless it is one of a number of 
special characters that indicate variable characters in the input string. An 
example subset of regular expression definitions and their meanings is 
given below: 



Pattern 


Meaning 




Matches an arbitrary character 


(...) 


Groups a series of pattern elements to a single element 


A 


Matches the beginning of the target 


+ 


Matches the preceding pattern elements one or more times. For example, 
ba+c matches bac, baac, but not be. 


s 


Matches the end of the line. For example, 100$ matches 100 at the end of a 
line. 


[...] 


Denotes a class of characters to match; ( A .. J negates the class. For 
example, b[aeiou]d matches bad, bed, bid, bod, and bud (but not bead or 
beed); and r[eo]+d matches red, rod, reed, rood, reod, roed, reood, roeod, 

etc. 


[ A ] 


Matches any character except those following the caret ( A ) character in the 
brackets, or any of an ASCII range of characters separated by a hyphen (-). 
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ror example, x[ U-yj matcnes xa, xo, xc 7 ana so on, our noi au, xj, xz, ana 
so on. 




Matches one of the alternatives 


? 




* 


Matches the preceding character zero or more times. For example* ba*c 
matches be, bac, baac, and so on. 




Matches any sequence of characters between the escaped braces. For 
example, {ju}+firoit matches jufruit, jujufruit, but not ufhut, jfhrit, or 
ujfhrit 


\ 


Removes the pattern match characteristics from the special characters listed 
above. For example, 100$ matches 100 at the end of a line, but 100\$ 
matches the character string 100$ anywhere on a line. 



In addition, section 2106 of the MPEP states: "Office personnel have the 
burden to establish a prima facie case that the claimed invention as a whole is 
directed to solely an abstract idea or to manipulation of abstract ideas or does not 
produce a useful result Only when the claim is devoid of any limitation to a 
practical application in the technological arts should it be rejected under 35 U-S.C 
101. (emphasis added). This section continues by clarifying the Office's burden 
when such a rejection is made by stating: "Office personnel must expressly state 
how the language of the claims has been interpreted to support the rejection." 
(emphasis added). 

Here, the Office offers no basis for its argument that this claim "solely 
teaches to the manipulation of abstract data, and is not tangibly embodied." 
Specifically, no explanation is proffered to explain how the language of the claim 
has been interpreted by the Office to lead to its conclusion. Thus, the Office has 
not met its burden in regards to this rejection. Furthermore, as discussed above, 
this claim produces a "useful, concrete and tangible result" and is not devoid of 
any limitation to a practical application. 

Accordingly, for the reasons given above, this rejection should be 
withdrawn. 
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The § 112 Rejections 

Claims 1-17, 22-31, and 33 stand rejected under 35 IXS.C. § 1 12, second 
paragraph, as being indefinite for "failing to particularly point out and distinctly 
5 claim the subject matter which Applicant regards as the invention." In making out 
this rejection, the Office argues that the phrase . . content that is designed to 
constitute . . renders the claims indefinite because it makes it unclear as to 
whether the content must actually be one of the enumerated types of attack 
9 patterns. Applicant respectfully disagrees and traverses the Office's rejections. 

In its reasoning, the Office states in its current Action: "content that is 
'designed to constitute' something may or may not actually constitute it, 
12 depending on the quality of the design. It is therefore uncertain that the limitations 
n subsequently recited would actually be part of the invention, thereby making the 
H claims indefinite." This line of reasoning is misplaced. Whether the design is one 
15 that would successfully be able to wage an attack is, for all intents and purposes, 
irrelevant to the claimed subject matter. Rather, Applicant's disclosure and at 
i7 least some of its specifically claimed embodiments are directed to methods and 
ts systems that can recognize problematic attack patterns (whether or not they would 
19 successfully wage an attack), and then do something about them. 
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The § 102 Rejections 

Claims 32 and 34 stand rejected under 35 U.S.C. § 102(e) as being 

23 anticipated by U.S. Patent No. 5,884,033 to Duvall et al (hereinafter, "Duvall"). 

24 Claim 32 recites a Web server input string screening method comprising: 
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determining an attack pattern that can be used to attack a Web 
server; 

defining a search pattern that can be used to detect the attack pattern, 
the search pattern being specified as a regular expression; 
screening received input strings using the search pattern to ascertain 
whether the attack pattern is present; and 

implementing a remedial action if the search pattern is found to 
contain an attack pattern. 



In making out the rejection of this claim, the Office argues that Duvall 
anticipates the claimed subject matter. Specifically, the Office states that Duvall 
"defines a plurality of unwanted input strings to be filtered (see column 3, line 64 
to column 4, line 1 1), a search pattern that permits variability, can search a portion 
of the string, and has wildcard characters (see column 6, lines 28-42), receives an 
input string on a web server (see column 8, lines 18-27), evaluates the strings, and 
takes remedial action if necessary, including denying the request (see column 6, 
line 60 to column 7, line 13)." 

Applicant submits that Duvall does not anticipate this claim and traverses 
this rejection. Applicant respectfully reminds the Office that "for anticipation 
under 35 U,S,C, 102, the reference must teach every aspect of the claimed 
invention either explicitly or impliedly. Any feature not directly taught must be 
inherently present: 7 (MPEP § 706,02). 

The first element of this claim recites "determining an attack pattern that 
can be used to attack a Web server. Duvall does not disclose this; and, in fact, the 
Office does not even cite Duvall for this feature. Furthermore, Duvall does not 
even remotely suggest determining an attack pattern that can be used to attack a 
Web server. 
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Furthermore, on pages 5-6 of the current Office Action, the Office itself 
acknowledges that Duvall only discloses filtering objectionable material and does 
not disclose filtering of attacks on a system. The pertinent excerpt is reproduced 
below: 

OuvaBoaty dl&ciosc* the use Of the invention fbrth*f*terw>g efURLte that ere 
misted to materiel theft * objectionable, depending upon the usafs tastes end 

sensfthrfttfts (see cotumrt 2. lines 12-20), The fltering of attacks on a system, such as a 
disclosure attack, integrity attack, or a denial of service attack, is not cfisctosed. 

Additionally, Applicant submits that Duvall discloses nothing of search 
patterns that are useable to search for an attack pattern that can be used to attack a 
Web server. 

Accordingly, as Duvall does not disclose or suggest the subject matter of 
this claim, this claim is allowable. 

Claim 34 recites one or more computer readable media having computer- 
readable instructions thereon which, when executed by a computer, perform the 
following steps: 



• dete rmining an attack pattern that can be used to attack a Web 
server; 

• defining a search pattern that can be used to detect the attack pattern, 
the search pattern being specified as a regular expression; 

• screening received input strings using the search pattern to ascertain 
whether the attack pattern is present; and 

• implementing a remedial action if the search pattern is found to 
contain an attack pattern. 
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In making out the rejection of this claim, the Office argues that Duvall 
anticipates the claimed subject matter. As discussed above, Duvall does not even 
remotely suggest determining an attack pattern that can be used to attack a Web 
serve, and does not disclose defining a search pattern, as claimed. 

Accordingly, as Duvall does not disclose or suggest the subject matter of 
this claim, this claim is allowable* 

The S 103 Refections 

Claims 1-11, 13-30, and 33 stand rejected under 35 U.S.C. § 103(a) as 
being unpatentable over Duvall in view of U.S. Patent No. 6,421,781 to Fox et al 
(hereinafter, "Fox"). 

Claims 12 and 31 stand rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Duvall in view of Fox and Oliver et aL, "Building a Windows 
NT 4 Internet Server", 1996, p. 203. 

Claim 1 recites a Web server input string screening method comprising: 

• determining an attack pattern that can be used to attack a Web 
server, the attack pattern comprising content that is designed to 
constitute one or more of a disclosure attack, an integrity attack or a 
denial of service attack on the Web server; 

• defining a search pattern that can be used to detect the attack pattern, 
the search pattern being defined in a manner that permits variability 
among its constituent parts; 

• receiving an input string that is intended for use by a Web server; 

• evaluating the input string using the search pattern to ascertain 
whether the attack pattern is present; and 

• implementing a remedial action if an attack pattern is found that 
matches the search pattern. 
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In making out the rejection of this claim, the Office states that "Duvall only 
discloses filtering of URL's that are related to material that is objectionable, 
depending upon the user's tastes and sensitivities/ 1 The Office further states that 
"[t]he filtering of attacks on a system, such as a disclosure attack, integrity attack, 
or a denial of service attack, is not disclosed." 

The Office then argues that it would have been obvious "to use the 
invention of Duvall by checking a URL against domain names, as disclosed by 
Fox, in order to protect against abusive denial-of-service attacks." 

Applicant respectfully disagrees and submits that there would have been no 
motivation to modify Duvall with Fox. The references themselves provide no 
such motivation. Additionally, the Office has failed to present a convincing line 
of reasoning (as required by 35 U.S.C. § 132 (see also MPEP 706.02(j))), that is 
stated with particularity and which explains why it would have been obvious to 
incorporate the teachings of Duvall and Fox, To support the conclusion that the 
claimed invention is directed to obvious subject matter, either the references must 
expressly or impliedly suggest the claimed invention or the examiner must present 
a convincing line of reasoning as to why the artisan would have found the claimed 
invention to have been obvious in light of the teachings of the references. See, 
e,g. Ex parte Clapp, 227 USPQ 972, 973 (Bd. Pat. App. & Inter. 1985). 

Here, the Office's stated motivation "in order to protect against abusive 
denial-of-service attacks** is misplaced because it merely recites the disclosure of 
Fox and does not explain why a skilled artisan concerned with the invention of 
Duvall would have been motivated to protect against attacks on a system. 

Applicant submits that an artisan concerned with the invention of Duvall 
would not have been motivated to implement the teachings of Fox because Fox 
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provides functionality completely different from the intended purpose of Duvall. 
Specifically, Duvall is concerned with filtering material (including identifying 
patterns in substrings or embedded in a string) that is personally objectionable, 
and is not concerned with attacks against a server. Fox, in contrast, is concerned 
with performing a literal string comparisons to limit abuse by malicious attacks. 

Furthermore, so far as Fox discloses performing literal string comparisons, 
it teaches away from Duvall's method of identifying patterns found in substrings 
or embedded in a string. In fact, performing literal string comparisons, as taught 
by Fox, would change the principle of operation of Duvall because a potentially 
objectionable term, as Duvall filters out, might merely be a part of a phrase 
containing otherwise unobjectionable terms, (see Duvall, column 6, lines 30-32). 
In Duvall, it is unlikely that such terms would be identified if literal string 
comparisons were used because DuvalTs filtering system compares portions of 
messages, and uses wildcard characters, not literal string comparisons, to 
accomplish filtering, (see Duvall, column 6, lines 34-37). In feet, performing 
Fox's literal string comparisons in Duvall would effectively render Duvall 
unsatisfactory for its intended purpose of filtering portions of incoming and/or 
outgoing messages. Accordingly, an artisan would have no motivation to combine 
the teaching of such discordant references- 

In responding to Applicant's previous assertion that no motivation exists to 
combine these references, the Office states: "Duvall discloses all of the limitations 
of the claimed invention, save for the use of the invention for screening URL's for 
particular kinds of attacks." The Office then states: "Fox discloses such an 
application and the motivation is sufficient to suggest to one skilled in the art to 
attempt to use Duvall's mechanism for detecting denial-of-service attacks." 
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Applicant vigorously submits that the Office's response begs the question and 
does not explain why a skilled artisan concerned with the invention of Duvall 
would have been motivated to protect against attacks on a system. 

Additionally, and as an aside, the Office has provided a paper, available at 

the following link: 

http ://www.uspto.gov/weWmemi/busmethp/busmeth 1 03re j .htm 

that describes proper and improper rejections made under § 103(a). 
Particularly instructive is a portion that appears in Section IV of the paper which 
provides guidance in regards to communicating a proper § 103(a) rejection. The 
pertinent part of this paper is reproduced below for the Office's convenience: 



IV. Communicating the Rationale for a Proper Rejection under 35 U.S.C. 
103 

When an examiner rejects a claim as failing to meet one or more of the statutory 
requirements for patentability, administrative due process and 35 U- S.C. 132 
require that applicant be adequately notified of the reasons for the rejection of the 
claim so that applicant can decide how to proceed The statutory requirement that 
an Office action state the reasons for any rejection is critical to proper action 
taking. 

hi writing a rejection under 35 U,SC. 103, the examiner should appropriately 
communicate : 

(1) the particular part of a reference being relied upon should be designated as 
nearly as practicable; 37 CFR § 1.104(c)(2); 

(2) the differences between the claimed invention and the closest prior art; 

(3) where the differences are found or suggested in the prior art; 

(4) how the teachings of the prior art arc combined; and 

(5) why the combination of those teachings would have been obvious to one of 
ordinary skill in the art at the time the invention was made. Do not recite the 
disclosure of the prior art which reads on the claimed invention as the 
motivation. Communicate why the references themselves, the knowledge of one 
of ordinary skill in the art, or the nature of the problem to be solved establishes 
a motivation to combine the prior art references. 
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Once applicant has presented rebuttal evidence, examiners should reconsider any 
initial obviousness determination in view of the entire record. All the proposed 
rejections and their bases should be reviewed to confirm their correctness. Only 
then should any rejection be imposed in an Office action. The Office action 
should clearly communicate the Office's findings and conclusions, articulating 
how the conclusions are supported by the findings. 



Here, as discussed above, the Office's stated motivation merely recites the 
disclosure of Fox and is unacceptable, as demonstrated by the Office's own 
guidance given above: 

"[d]o not recite the disclosure of the prior art which reads on the claimed 
invention as the motivation " 



Accordingly, this rejection is improper, 

In view of the above discussion, the Office's rejection is misplaced and 
does not establish a prima facie case of obviousness. Hence, for at least these 
reasons, this claim is allowable. 

Claims 2-6 and 33 depend from claim 1 and are allowable as depending 
from an allowable base claim. These claims are also allowable for their own 
recited features which, in combination with those recited in claim 1, are neither 
disclosed nor taught by the references of record, either singly or in combination 
with one another. 

Claim 7 recites a Web server input string screening method comprising; 

* defining one or more search patterns that comprise literal characters 
and special characters, wherein the literal characters indicate exact 
characters in an input string that is intended for receipt by a Web 
server, and the special characters indicate variable characters in an 
input string that is intended for receipt by the Web server, the search 
patterns being usable to search for an attack pattern that can be used 
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to attack the Web server, the attack pattern comprising content that 
is designed to constitute one or more of a disclosure attack, an 
integrity attack or a denial of service attack on the Web server; and 
• storing the one or more search patterns in a memory location that is 
accessible to a screening tool for evaluating an input string that is 
intended for receipt by the Web server. 

In making out the rejection of this claim, the Office has not addressed all of 
the elements of this claim. Specifically, the only argument proffered by the Office 
regarding this claim is found on page 6 of the Office Action, which is reproduced 
below: 

As per claims 7-10, 1S-16, 26. 27. 29, and 30. 0*a«/? discloses that me search 
patterns may be stored In RAM (see column 3» lines 45-49)* 



Applicant therefore traverses this rejection and respectfully reminds the 
Office that "it is important that the written record clearly explain the rationale for 
decisions made during prosecution of the application*" MPEP 706.02 (j)). 
Applicant respectfully requests that the Office properly communicate the basis for 
its rejection of this claim. 

Nevertheless, the references cited by the Office do not teach or suggest all 
of the subject matter of this claim. Additionally, as discussed above, the Office 
has not explained why it would have been obvious to incorporate the teachings of 
Duvall and Fox. Hence, for at least these reasons, the Office has not established a 
prima facie case of obviousness and this claim is allowable. 

Claims 8-12 depend from claim 7 and are allowable as depending from an 
allowable base claim. These claims are also allowable for their own recited 
features which, in combination with those recited in claim 7, are neither disclosed 
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nor taught by the references of record, either singly or in combination with one 
another. In addition, given the allowability of claim 7, the rejection of claim 12 
over the combination with Oliver is not seen to add anything of significance. 

Claim 13 recites a Web server input string screening method comprising: 

• defining one or more search patterns that are specified as a regular 
expression, the search patterns being usable to search for an attack 
pattern (hat can be used to attack the Web server, the attack pattern 
comprising content that is designed to constitute one or more of a 
disclosure attack, an integrity attack or a denial of service attack on 
the Web server; and 

• storing the one or more search patterns in a memory location that is 
accessible to a screening tool for evaluating an input string that is 
intended for receipt by the Web server. 

In making out the rejection of this claim, the Office has not addressed all of 
the elements of this claim. Specifically, the only argument proffered by the Office 
regarding this claim is found on page 6 of the Office Action, which is reproduced 
above. 

Nevertheless* the references cited by the Office do not teach or suggest all 
of the subject matter of this claim. Additionally, as discussed above, the Office 
has not explained why it would have been obvious to incorporate the teachings of 
Duvall and Fox. Hence, for at least these reasons, the Office has not established a 
prima facie case of obviousness and this claim is allowable. 
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Claims 14-17 depend from claim 13 and are allowable as depending from 
an allowable base claim. These claims are also allowable for their own recited 
features which, in combination with those recited in claim 13, are neither disclosed 
nor taught by the references of record, either singly or in combination with one 
another. 

Claim 18 recites a Web server input string screening tool embodied on a 
computer-readable medium comprising: 



• a pattern matching engine that is configured to receive an input 
string that is intended for use by a Web server and evaluate the input 
string to ascertain whether it likely constitutes an attack on the Web 
server, the attack comprising one or more of a disclosure attack, an 
integrity attack or a denial of service attack on the Web server; and 

• one or more patterns that are usable by the pattern matching engine 
to evaluate the input string, the patterns being defined in a manner 
that permits variability among the constituent parts of the one or 
more patterns, 



In making out the rejection of this claim, the Office relies on the same 
argument that it made in regards to claim 1. Applicant respectfully disagrees with 
the Office and maintains that the Office has not established a prima facie case of 
obviousness. Hence, for at least these reasons, this claim is allowable. 
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Claims 19-21 depend from claim 18 and are allowable as depending from 
an allowable base claim. These claims are also allowable for their own recited 
features which, in combination with those recited in claim 18, are neither disclosed 
nor taught by the references of record, either singly or in combination with one 
another. 

Claim 22 recites one or more computer readable media having computer- 
readable instructions thereon which, when executed by a computer perform the 
following steps: 



receiving an input string that is intended for use by a Web server; 
evaluating the input string using a search pattern to ascertain 
whether the input string contains an attack pattern that can be used to 
attack the Web server, the attack pattern comprising content that is 
designed to constitute one or more of a disclosure attack, an integrity 
attack or a denial of service attack on the Web server, the search 
pattern comprising literal characters and special characters, wherein 
literal characters indicate exact characters in the input string, and the 
special characters indicate variable characters in the input string; and 
implementing a remedial action if an attack pattern is found that 
matches the search pattern. 



In making out the rejection of this claim, the Office has not addressed all of 
the elements of this claim. Specifically, the only argument proffered by the Office 
regarding this claim is found on page 6 of the Office Action, which is reproduced 
below: 

As per claims 17 end 22*25, the progr^ is* 
disk) before being installed (see column 10. fines 64-68). 
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Applicant therefore traverses this rejection and respectfully requests that the 
Office properly communicate the basis for its rejection of this claim. 

Nevertheless, the references cited by the Office do not teach or suggest all 
of the subject matter of this claim. Additionally, as discussed above, the Office 
has not explained why it would have been obvious to incorporate the teachings of 
Duvall and Fox. Hence, for at least these reasons, the Office has not established a 
prima facie case of obviousness and this claim is allowable. 

Claims 23-25 depend from claim 22 and are allowable as depending from 
an allowable base claim. These claims are also allowable for their own recited 
features which, in combination with those recited in claim 22, are neither disclosed 
nor taught by the references of record, either singly or in combination with one 
another. 

Claim 26 recites a collection of Web server screening patterns embodied on 
a computer-readable medium comprising: 



• a memory; and 

• a plurality of patterns stored in the memory, the patterns being 
useable to screen input strings that are intended for use by a Web 
server to ascertain whether the input strings comprise attack patterns, 
the attack patterns comprising content that is designed to constitute 
one or more of a disclosure attack, an integrity attack or a denial of 
service attack on the Web server, individual patterns being defined 
in a manner that permits variability among their constituent parts. 



In making out the rejection of this claim, the Office has not addressed all of 
the elements of this claim. Specifically, the only argument proffered by the Office 
regarding this claim is found on page 6 of the Office Action, which is reproduced 
above. 
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Nevertheless, the references cited by the Office do not teach or suggest all 
of the subject matter of this claim. Additionally, as discussed above, the Office 
has not explained why it would have been obvious to incorporate the teachings of 
Duvall and Fox. Hence, for at least these reasons, the Office has not established a 
prima facie case of obviousness and this claim is allowable. 

Claims 27-31 depend from claim 26 and are allowable as depending from 
an allowable base claim. These claims arc also allowable for their own recited 
features which, in combination with those recited in claim 26, are neither disclosed 
nor taught by the references of record, either singly or in combination with one 
another In addition, given the allowability of claim 26, the rejection of claim 31 
over the combination with Oliver is not seen to add anything of significance. 

Conclusion 

Applicant respectfully submits that all of the claims are in condition for 
allowance and Applicant respectfully requests a Notice of Allowability be issued 
forthwith. If the next anticipated action is to be anything other than issuance of a 
Notice of Allowability, Applicant respectfully requests a telephone call for the 
purpose of scheduling an interview. 
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Respectfully Submitted, 



Dated: 




Reg- No. 38,605 
(509) 324-9256 
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